crates.io: DoS Attack
Affected components: crates.io
Timeline of updates
- investigating
We are experiencing what looks like a coordinated DoS attack against our API servers. We are monitoring the situation and are assessing our reaction. Crate downloads and dependency resolution through the sparse/git index should not be affected.
- investigating
We are continuing to investigate this issue.
- monitoring
We have deployed countermeasures and our servers are largely back to normal again. We keep monitoring the situation. If you encounter any issues please let us know!
- resolved
This incident has been resolved. Big thanks to Fastly for providing their CDN services and their fast response time!
Changes Rewindex caught on this incident
Archive proof
Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves this record existed by then and has not been changed since, by anyone, Rewindex included.
How the archive is checked, and what it cannot prove.
First version captured 17:33 UTC
In the 2026-10-19 checkpoint, timestamped by FreeTSA and DigiCert on Oct 20, 00:41 UTC. Record hash
5d220ae0cbd0e05f…
Impact, status and times are the vendor’s own, as last archived. View on stspg.io (opens in new tab).